Skip to main content
Glama
fredriksknese

mcp-activedirectory

mcp-activedirectory

A Model Context Protocol (MCP) server for Microsoft Active Directory, providing AI assistants with access to on-prem AD (via LDAP) and Azure AD / Entra ID (via Microsoft Graph API).

Features

Supports two modes simultaneously:

  • On-prem Active Directory — connects to a domain controller via LDAP/LDAPS using the ldapts library

  • Azure AD / Entra ID — connects via the Microsoft Graph API using OAuth2 Client Credentials

18 tools across five categories:

User Management

Tool

Description

list_users

List users with optional name, email, or department filter

get_user

Get full user details including decoded UAC flags (on-prem) or full profile (Azure AD)

get_user_groups

List all groups a user is a member of

search_users

Advanced search by name, email, department, title, phone, or UPN

Group Management

Tool

Description

list_groups

List groups with optional name filter

get_group

Get group details including member count and decoded group type

get_group_members

List all group members; supports recursive nested group expansion (on-prem)

search_groups

Search groups by name or description

Computer Accounts (On-prem AD only)

Tool

Description

list_computers

List computer accounts with OS, last logon (human-readable), and OU

get_computer

Get full computer account details

search_computers

Search by name, OS, OU path, DNS hostname, or description

Organizational Units (On-prem AD only)

Tool

Description

list_ous

List OUs with full path, sorted by depth

get_ou

Get OU details

search_ous

Search OUs by name, description, or parent path

Azure AD / Entra ID (Azure AD only)

Tool

Description

list_devices

List Entra ID registered/joined devices with OS and compliance status

get_device

Get full device details by object ID

list_service_principals

List app registrations and service principals

get_user_sign_in_activity

Get last sign-in information for a user

Related MCP server: Microsoft MCP

Installation

git clone git@github.com:fredriksknese/mcp-activedirectory.git
cd mcp-activedirectory
npm install
npm run build

Configuration

The server is configured via environment variables. At least one of AD_HOST or AZURE_TENANT_ID must be set.

On-prem Active Directory (LDAP)

Variable

Required

Default

Description

AD_HOST

Yes

Domain controller hostname or IP address

AD_PORT

No

389

LDAP port (636 for LDAPS)

AD_USE_SSL

No

false

Use LDAPS (true/false)

AD_BIND_DN

Yes

Bind DN, e.g. CN=svc-mcp,OU=Service Accounts,DC=corp,DC=example,DC=com

AD_BIND_PASSWORD

Yes

Bind account password

AD_BASE_DN

Yes

Base DN for all searches, e.g. DC=corp,DC=example,DC=com

AD_ALLOW_SELF_SIGNED

No

true

Accept self-signed TLS certificates

Azure AD / Entra ID (Microsoft Graph API)

Variable

Required

Default

Description

AZURE_TENANT_ID

Yes

Azure AD tenant ID (GUID)

AZURE_CLIENT_ID

Yes

App registration (client) ID

AZURE_CLIENT_SECRET

Yes

App registration client secret

Required Permissions

On-prem Active Directory

The service account (AD_BIND_DN) needs read access to the directory. The minimum required permissions are:

  • Read on User objects (all attributes listed below)

  • Read on Group objects

  • Read on Computer objects

  • Read on OrganizationalUnit objects

Recommended: add the service account to the built-in Domain Users group and grant Read delegated permissions on the domain root, or use the built-in Read-only Domain Controllers access pattern.

Attributes read for users: cn, sAMAccountName, displayName, mail, userPrincipalName, department, title, telephoneNumber, mobile, manager, memberOf, userAccountControl, lastLogon, whenCreated, whenChanged, description, distinguishedName, objectGUID

Azure AD / Entra ID (Microsoft Graph)

Create an App Registration in Azure AD and grant the following Application permissions (not Delegated):

Permission

Scope

Required for

User.Read.All

Microsoft Graph

Reading user profiles and group memberships

Group.Read.All

Microsoft Graph

Reading groups and group members

Device.Read.All

Microsoft Graph

Reading Entra ID registered/joined devices

AuditLog.Read.All

Microsoft Graph

Reading sign-in activity (signInActivity field)

Grant Admin Consent for all permissions in the Azure portal.

Usage with Claude Desktop

Add to your claude_desktop_config.json:

On-prem AD only

{
  "mcpServers": {
    "activedirectory": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
      "env": {
        "AD_HOST": "dc01.corp.example.com",
        "AD_BIND_DN": "CN=svc-mcp,OU=Service Accounts,DC=corp,DC=example,DC=com",
        "AD_BIND_PASSWORD": "your-service-account-password",
        "AD_BASE_DN": "DC=corp,DC=example,DC=com"
      }
    }
  }
}

Azure AD / Entra ID only

{
  "mcpServers": {
    "activedirectory": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
      "env": {
        "AZURE_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Both simultaneously

{
  "mcpServers": {
    "activedirectory": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-activedirectory/dist/index.js"],
      "env": {
        "AD_HOST": "dc01.corp.example.com",
        "AD_BIND_DN": "CN=svc-mcp,OU=Service Accounts,DC=corp,DC=example,DC=com",
        "AD_BIND_PASSWORD": "your-service-account-password",
        "AD_BASE_DN": "DC=corp,DC=example,DC=com",
        "AZURE_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Usage with Claude Code

claude mcp add activedirectory -- node /absolute/path/to/mcp-activedirectory/dist/index.js

LDAPS / SSL Configuration

To use LDAPS (port 636):

"env": {
  "AD_HOST": "dc01.corp.example.com",
  "AD_PORT": "636",
  "AD_USE_SSL": "true",
  "AD_ALLOW_SELF_SIGNED": "true"
}

Set AD_ALLOW_SELF_SIGNED to "false" if your domain controller uses a certificate from a trusted CA.

Example Prompts

Once connected, you can ask your AI assistant things like:

  • "List all users in the IT department"

  • "Get details for user jdoe including their group memberships"

  • "Which groups does john.doe@company.com belong to?"

  • "Show me all members of the Domain Admins group"

  • "List all Windows Server 2022 computers in the Servers OU"

  • "Which computer accounts haven't logged in since 2024?"

  • "Show me the top-level OUs in the domain"

  • "List all Azure AD joined devices"

  • "When did user@company.com last sign in?"

  • "List all service principals of type ManagedIdentity"

Architecture

src/
├── index.ts              # Entry point — creates MCP server + STDIO transport
├── ad-client.ts          # LDAP client wrapping ldapts for on-prem AD
├── graph-client.ts       # Microsoft Graph API client with OAuth2 token caching
└── tools/
    ├── users.ts          # User tools (list, get, search, groups) — AD + Azure
    ├── groups.ts         # Group tools (list, get, members, search) — AD + Azure
    ├── computers.ts      # Computer account tools — on-prem AD only
    ├── ous.ts            # Organizational unit tools — on-prem AD only
    └── azure.ts          # Azure-specific tools (devices, service principals, sign-in)

Development

npm run dev      # Run with tsx (no compilation needed)
npm run build    # Compile TypeScript to dist/
npm start        # Run compiled output

Requirements

  • Node.js 18+

  • For on-prem AD: network access to a domain controller on port 389 (LDAP) or 636 (LDAPS)

  • For Azure AD: an App Registration with the required Graph API permissions

License

SEE LICENSE IN LICENSE

Available Tools

18 tools
get_computerA

Get full details of a specific computer account by name.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesComputer name (CN or NetBIOS name, without trailing $)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Lacks annotations, but description states it's a read operation ('Get full details'). Could mention that it does not modify the computer and has no side effects, but it's adequate for this simple case.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, 10 words, front-loaded with key information. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, description covers the essential purpose and parameter hint. Could mention that output is a computer object, but not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters; description adds value by specifying name format (CN or NetBIOS without trailing $), going beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Get' and resource 'full details of a specific computer account', clearly distinguishing from list_computers (list all) and search_computers (search) siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage when you have a specific computer name and need full details, but no explicit guidance on when not to use or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_deviceA

Get full details of a specific Entra ID device by its object ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesDevice object ID (GUID) from Azure AD / Entra ID

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries full burden. It states 'get full details' but does not clarify what 'full details' includes (e.g., specific properties, response structure) or any edge cases (e.g., device not found). It lacks important behavioral context such as whether the operation is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that efficiently conveys the tool's purpose without any unnecessary words or formatting issues.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and no output schema, the description adequately conveys the core purpose. However, it could be improved by noting the response behavior (e.g., returns all device properties) or handling of non-existent IDs. For a simple retrieval tool, it is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides a clear description for the 'id' parameter ('Device object ID (GUID) from Azure AD / Entra ID'). The description adds 'by its object ID', which reinforces but does not add new meaning beyond the schema coverage of 100%. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get', the resource 'full details of a specific Entra ID device', and the method 'by its object ID'. It effectively distinguishes from sibling tools like list_devices (which returns multiple) and get_computer (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving a single device by ID but does not explicitly state when to use this tool over alternatives (e.g., get_computer for computer objects) or mention any exclusions. Context can be inferred from sibling names, but no direct guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_groupA

Get full details of a specific group including member count. For on-prem AD use CN or sAMAccountName; for Azure AD use display name or object ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYesGroup name (CN/sAMAccountName) for on-prem AD, or display name/object ID for Azure AD
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral disclosure. It states the tool returns 'full details' and 'member count' but does not mention any side effects, required permissions, rate limits, or error behavior. The description is adequate but lacks depth for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loading the purpose immediately. Every sentence serves a clear function: first establishes purpose and key output, second provides critical parameter differentiation. No redundant or extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description should convey what 'full details' entails beyond member count. It leaves ambiguity about the response structure. While the parameter schema is thorough, the incomplete output description and lack of error or edge-case handling make it minimally adequate for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description's contribution is additive. It reinforces the identifier format guidance already in the schema, but adds the detail 'including member count' which hints at output structure. This adds value beyond the schema, earning a score above baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get full details') and the resource ('specific group'), including the specific output detail 'member count'. It also distinguishes between on-prem and Azure AD by providing identifier guidance, which helps differentiate this tool from siblings like 'get_group_members' or 'list_groups'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use CN/sAMAccountName vs display name/object ID based on the source, which is helpful for correct parameter usage. However, it does not explicitly compare this tool to alternatives (e.g., when to use 'get_group' vs 'get_group_members'), missing an opportunity to prevent misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_group_membersA

List all members of a group with user details. Supports recursive expansion of nested groups for on-prem AD.

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYesGroup name (CN/sAMAccountName) for on-prem AD, or display name/object ID for Azure AD
recursiveNoRecursively expand nested groups to return all transitive members (on-prem AD only)
max_resultsNoMaximum number of members to return
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral traits. It discloses recursive expansion but omits details like pagination, rate limits, authentication, or output structure (e.g., what 'user details' include). Essential behavioral context is lacking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no extraneous information. The first sentence states the core purpose, and the second adds the key special feature (recursive expansion). Excellent conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the basic function and a key feature, but lacks explanation of the return value (output structure). Since there is no output schema, the description should clarify what 'user details' means. Some aspects (like max_results behavior) are left to the schema. Overall adequate but with gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema fully describes all four parameters. The description adds no new meaning beyond what's in the schema (e.g., 'recursive' is already documented). With high coverage, baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists group members with user details and supports recursive expansion for on-prem AD. It distinguishes from siblings like get_group (group properties) and get_user_groups (user's groups) by focusing on member listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing group members and mentions recursive expansion, but it does not explicitly state when to use this tool versus alternatives (e.g., 'use get_group for group properties'). Context from sibling tools provides implicit guidance, but explicit when-not or alternatives are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_ouA

Get details of a specific organizational unit including child object counts.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesOU name (ou attribute value, e.g. 'Servers') or partial distinguished name

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It implies a read operation but does not explicitly state it's read-only, nor does it discuss error handling, permissions, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that conveys the tool's purpose efficiently, with no redundant content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the key output element (child object counts), but without an output schema, it could list additional details returned (e.g., name, description, path). Adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the 'name' parameter, but the description adds valuable context: 'OU name (ou attribute value, e.g. 'Servers') or partial distinguished name', clarifying acceptable input formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Get' and the resource 'details of a specific organizational unit including child object counts'. It distinguishes from sibling tools like list_ous and search_ous by focusing on a single OU.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Despite sibling tools like list_ous and search_ous, the description does not mention when to prefer this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_userA

Get full details of a specific user. For on-prem AD use sAMAccountName; for Azure AD use UPN or object ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYessAMAccountName for on-prem AD, or UPN/object ID for Azure AD (e.g. jdoe or john.doe@company.com)
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It clarifies identifier format per source but does not explain what 'full details' entails, permissions needed, or any side effects. This is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no redundant information. The first sentence states the tool's purpose, and the second provides specific usage guidance. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low complexity (2 parameters, 1 required, schema covers all), the description is sufficient for tool selection and invocation. While it doesn't describe the output format, the lack of an output schema is mitigated by the tool's straightforward nature.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the description adds limited value beyond the schema. It rephrases the identifier guidance, but the schema already includes similar details. With high coverage, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get full details of a specific user,' using a specific verb and resource. It also distinguishes usage between on-prem AD and Azure AD, differentiating it from sibling tools like get_user_groups or list_users.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on identifier selection per source (sAMAccountName for on-prem, UPN/object ID for Azure). It implies when to use this tool versus alternatives, but could be more explicit about when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_user_groupsA

List all groups a user is a member of (direct and via memberOf attribute).

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYessAMAccountName for on-prem AD, or UPN/object ID for Azure AD
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must fully disclose behavioral traits. It mentions inclusion of transitive memberships (via memberOf), which is good, but omits details on auth requirements, rate limits, or output formatting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no extraneous words. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with two well-documented parameters and no output schema, the description is mostly complete. It could mention error handling or pagination, but for typical use it's sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains the parameters. The tool description adds no additional parameter information, achieving only the baseline value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (list all groups), the target (a user), and the scope (direct and via memberOf). It distinguishes from sibling tools like get_group_members and other get/list tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving a user's group memberships but provides no explicit guidance on when to use this tool versus alternatives, such as get_group_members for the inverse operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_user_sign_in_activityA

Get last sign-in information for a user in Azure AD / Entra ID. Requires AuditLog.Read.All permission.

ParametersJSON Schema
NameRequiredDescriptionDefault
identifierYesUser UPN (e.g. user@company.com) or object ID to retrieve sign-in activity for

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions the required 'AuditLog.Read.All' permission, which is a key behavioral trait. However, it does not describe the nature of the response (e.g., single object with fields) or any side effects. With no annotations, the burden is higher, but the permission detail adds value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that conveys the core action and a critical requirement, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers the essence: what the tool does and the key permission needed. It could optionally hint at the return format, but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes the 'identifier' parameter fully (UPN or object ID). The description adds no additional meaning beyond the schema, so with 100% schema coverage, baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get last sign-in information for a user in Azure AD / Entra ID', providing a specific verb and resource that distinguishes it from sibling tools like get_user or get_device.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description only mentions the required permission but does not provide explicit guidance on when to use this tool versus alternatives, nor does it exclude contexts where it would be inappropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_computersB

List computer accounts in Active Directory with OS, last logon, and OU information.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter by computer name (partial match)
osNoFilter by operating system (partial match, e.g. 'Windows Server 2022', 'Windows 10')
max_resultsNoMaximum number of results to return (default: 50)

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral transparency. It implies a read-only operation but does not disclose pagination behavior (though max_results parameter exists), rate limits, or potential performance impacts. The mention of returned fields (OS, last logon, OU) adds some value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence of 14 words that efficiently conveys the tool's purpose and key output fields. No redundant or extraneous information, and it is front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (3 parameters, no output schema, no annotations), the description is incomplete. It does not explain the output format, pagination handling, error cases, or how results are ordered. An agent would need additional context to reliably invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear parameter descriptions. The tool description does not add extra semantic meaning beyond what the schema already provides, such as clarifying the format of filters or the effect of max_results. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it lists computer accounts in Active Directory with specific attributes (OS, last logon, OU). However, it does not explicitly differentiate from sibling tools like list_devices or search_computers, which have similar listing purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance provided. The description does not indicate when to use this tool over alternatives, such as search_computers for more advanced filtering or get_computer for a single computer, nor does it mention prerequisites or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_devicesB

List devices registered or joined in Azure AD / Entra ID with OS and compliance status.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter by device display name (partial match)
osNoFilter by operating system (e.g. 'Windows', 'iOS', 'Android', 'macOS')
trust_typeNoFilter by trust type: AzureAD (Azure AD Joined), ServerAD (Hybrid Azure AD Joined), Workplace (Registered)
enabled_onlyNoReturn only enabled/active devices
max_resultsNoMaximum number of results to return (default: 50)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so description must carry burden. It mentions OS and compliance status as output, but lacks details on pagination, default filters, or rate limits. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no fluff. Could be reworded slightly for clarity (e.g., 'Lists all devices...') but overall concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description should clarify return format. It mentions OS and compliance status but omits ordering, pagination, and error conditions. Sufficient for basic understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 5 parameters. The description adds marginal value by hinting at return fields (OS, compliance status), but does not enhance parameter understanding beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists devices in Azure AD/Entra ID with OS and compliance status, using a specific verb and resource. It distinguishes from sibling tools like get_device which retrieves a single device.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description does not provide context for selection among siblings like list_computers or search_devices.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_groupsC

List Active Directory or Azure AD groups with optional name filter.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter by group name (partial match)
max_resultsNoMaximum number of results to return (default: 50)
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It fails to mention whether the tool is read-only, pagination behavior, return value structure, or any side effects. For a listing tool, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the core purpose without fluff. It could be slightly more information-dense while remaining concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, no output schema, and no annotations, the description should elaborate on behavior, return format, pagination, or limitations. It is too sparse to be fully useful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are well-defined in the schema. The description adds minimal extra meaning (e.g., 'optional name filter') beyond what the schema already provides via descriptions and enums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List Active Directory or Azure AD groups' with a specific verb and resource, and mentions an optional name filter. However, it doesn't distinguish from sibling tools like 'search_groups' or 'get_group', which share similar purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives like list vs search, or prerequisites for different sources. The description only states capability without usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_ousB

List organizational units (OUs) in Active Directory with their full path and details.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter by OU name (partial match)
max_resultsNoMaximum number of results to return (default: 100)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only says 'list' which implies read-only but does not disclose pagination, performance, or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, clear and to the point, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema; description vaguely mentions 'full path and details' without specifying structure, and lacks details on result format or constraints.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% description coverage; description adds 'full path and details' but does not significantly enhance understanding beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it lists organizational units with additional context ('full path and details'), and is distinguishable from sibling tools like get_ou or search_ous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like search_ous or list_groups; simple listing without usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_service_principalsA

List app registrations and service principals (enterprise applications) in Azure AD / Entra ID.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter by display name (partial match)
typeNoFilter by service principal type: Application, ManagedIdentity, Legacy, SocialIdp
max_resultsNoMaximum number of results to return (default: 50)

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behaviors. It only states 'List' without specifying read-only nature, permission requirements, pagination, or any side effects, providing minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that immediately communicates the tool's purpose without any extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is mostly complete for a simple list operation. It lacks mention of pagination, default limits, or behavior with large result sets, but is sufficient given the clear schema and lack of output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100 and parameters are described, the description adds no additional meaning beyond the schema. The mention of resource types provides some context, but no extra semantic enrichment.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the specific resources: 'app registrations and service principals (enterprise applications)' in Azure AD/Entra ID, distinguishing it from sibling tools that focus on computers, devices, groups, and users.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use instructions are given. The purpose implies usage for listing service principals, but no alternatives or exclusions are mentioned, leaving it to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_usersB

List Active Directory or Azure AD users with optional filters. Supports filtering by name, email, or department.

ParametersJSON Schema
NameRequiredDescriptionDefault
filterNoFilter string: name, email, or department to search for
departmentNoFilter by department (partial match)
max_resultsNoMaximum number of results to return (default: 50)
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only states the action and supported filter fields, lacking details on pagination, performance, authentication requirements, or what happens with large result sets.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two short sentences, covering the essential purpose without any wasted words. It is well-structured and easily readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of annotations and output schema, the description is minimal. It omits important context such as return format, ordering, default pagination behavior, or any limitations. A more complete description would address these aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are fully described in the schema. The description adds a brief summary of filter capabilities but does not provide additional semantic details beyond what the schema already offers, warranting a neutral score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists users from Active Directory or Azure AD with optional filters, which distinguishes its purpose from similar list tools for other resources like list_groups. However, it does not explicitly differentiate from search_users, but the verb 'list' implies a broader listing than searching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing users with filters but does not provide explicit guidance on when to use this tool versus alternatives like search_users or get_user. No exclusions or alternative suggestions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_computersA

Search computer accounts by name, operating system, or organizational unit path.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoSearch by computer name (partial match)
osNoSearch by operating system (partial match)
ouNoFilter by OU path — matches computers whose DN contains this string (e.g. 'OU=Servers')
descriptionNoSearch by description (partial match)
dns_nameNoSearch by DNS hostname (partial match)
max_resultsNoMaximum number of results

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must carry behavioral info. It describes search criteria but omits whether results are paginated, return format, or any rate limits. For a search tool with no output schema, this is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that directly states the tool's purpose and key search fields. No extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so description should clarify return format. It does not. Six parameters are documented but max_results default is 50 with no pagination explanation. Sibling differentiation is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. The description adds marginal value for the OU parameter ('matches computers whose DN contains this string') but merely repeats schema descriptions for others.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches computer accounts using name, OS, or OU path. It differentiates from siblings like 'get_computer' (single retrieval) and 'list_computers' (likely lists without search).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for searching but does not explicitly state when to use this tool versus alternatives like 'get_computer' or 'list_computers'. No exclusions or when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_groupsC

Search groups by name or description.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoSearch by group name (partial match)
descriptionNoSearch by description (partial match, on-prem AD only)
max_resultsNoMaximum number of results
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits like read-only nature, pagination, rate limits, or any side effects. The description alone is insufficient for an agent to understand the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence, but it lacks important details about parameters and usage. It is not overly verbose, but it sacrifices completeness for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the four parameters and no output schema or annotations, the description is incomplete. It does not explain how the 'source' parameter affects behavior, the default source, or that name and description are optional filters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the description's mention of searching by name or description adds little beyond the schema. The description does not elaborate on parameter interactions or provide additional context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'search' and the resource 'groups', and specifies search criteria (name or description). It is distinct from sibling tools like search_users or search_ous, though it could explicitly mention that it returns groups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as list_groups or get_group. There is no mention of prerequisites, context for use, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_ousC

Search organizational units by name or description.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoSearch by OU name (partial match)
descriptionNoSearch by description (partial match)
parentNoFilter by parent path — matches OUs whose DN contains this string (e.g. 'DC=corp,DC=example,DC=com')
max_resultsNoMaximum number of results

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden for behavioral disclosure. It only states the purpose and does not mention pagination, case sensitivity, match behavior, or any side effects. Minimal transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loading the purpose. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 4 parameters, no output schema, and no annotations, the description is too sparse. It does not explain return format, default behavior, or search nuances, making it incomplete for an AI agent to use correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all parameters have descriptions in the schema. The description does not add any new meaning beyond the schema. Per guidelines, baseline is 3 for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'search' and the resource 'organizational units', and specifies criteria by name or description. It distinguishes from list_ous and get_ou, but does not explicitly differentiate from other search tools like search_computers or search_groups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like list_ous, get_ou, or other search tools. An AI agent would need to infer usage from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_usersB

Advanced user search by any field: name, email, department, job title, or phone number.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoSearch by display name or CN (partial match)
emailNoSearch by email address (partial match)
departmentNoSearch by department (partial match)
titleNoSearch by job title (partial match)
phoneNoSearch by telephone number (partial match)
upnNoSearch by User Principal Name (partial match)
max_resultsNoMaximum number of results
sourceNoData source: "ad" for on-prem LDAP, "azure" for Azure AD/Entra ID (available: ad, azure)ad

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description carries full burden. Only states it's an 'advanced search' but omits behavioral details like result format, pagination, or side effects. Partial match behavior is only in schema, not description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence that is front-loaded with key action and resource. No unnecessary words, perfectly concise for a straightforward search tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 8 parameters and no output schema, description fails to explain return values, sorting, pagination, or other search behavior. Incomplete for an advanced search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions. Description adds value by listing fields in context but does not significantly enhance understanding beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly specifies the verb 'search' and resource 'users', lists multiple searchable fields (name, email, etc.), and distinguishes from siblings like 'list_users' and 'get_user' by emphasizing advanced search capabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as 'get_user' for exact match or 'list_users' for listing. Does not mention when not to use or any prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 18 tool updatesv1.0.0
    • First observedget_computer
    • First observedget_device
    • First observedget_group
    • First observedget_group_members
    • First observedget_ou
    • First observedget_user
    • First observedget_user_groups
    • First observedget_user_sign_in_activity
    • First observedlist_computers
    • First observedlist_devices
    • First observedlist_groups
    • First observedlist_ous
    • First observedlist_service_principals
    • First observedlist_users
    • First observedsearch_computers
    • First observedsearch_groups
    • First observedsearch_ous
    • First observedsearch_users

TDQS

A3.5/5.0
Disambiguation5/5

Each tool targets a distinct resource type or operation (e.g., get vs list vs search, computer vs device, group vs group members). There is no ambiguity between tools.

Naming Consistency5/5

All tool names follow the verb_noun pattern consistently (e.g., get_computer, list_users, search_groups). No mixing of naming conventions.

Tool Count5/5

18 tools cover both on-prem AD and Azure AD resources (users, groups, computers, devices, OUs, service principals) without being excessive. The scope is appropriate for a directory server.

Completeness2/5

The tool set is entirely read-only; there are no create, update, or delete operations. For an Active Directory server, this is a significant gap that prevents full lifecycle management.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    Provides secure access to Microsoft Entra ID (Azure AD) resources including users, devices, and applications through Microsoft Graph API. Enables querying organizational data with comprehensive audit logging to Azure Blob Storage.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to interact with Microsoft Graph API services including Outlook email, Calendar events, OneDrive files, and Contacts. Supports multiple Microsoft accounts with unified search across all services.
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables managing Active Directory users, groups, and computers using natural language, with support for queries and updates.
    56
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/fredriksknese/mcp-activedirectory'

If you have feedback or need assistance with the MCP directory API, please join our Discord server